GLAS-WP-0018: record hub ids from fix-consistency

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 23:52:29 +02:00
parent b386b796e3
commit 8faa14ae7b

View file

@ -10,6 +10,7 @@ owner: claude
topic_slug: session-agent-identity-tool-boundary
created: "2026-10-24"
updated: "2026-10-24"
state_hub_workstream_id: "4805066a-58f6-51c5-bc99-eabe9cd719d0"
---
# Session-scoped agent identity, attribution and tool boundary
@ -27,6 +28,7 @@ changed by drafting this plan.
id: GLAS-WP-0018-T01
status: todo
priority: high
state_hub_task_id: "c19c4644-058a-5a85-a840-3e917d86c58e"
```
Add optional `identity_ref` (subject, act.sub, jti, issuer, expiry; never the
@ -39,6 +41,7 @@ Add hashed evidence-receipt location and sha256. Tests; backwards compatible.
id: GLAS-WP-0018-T02
status: todo
priority: high
state_hub_task_id: "b1e1ac59-e03c-5e01-986f-721383888999"
```
Add a profile `boundary` block, record it in evidence, and fail the run when the
@ -53,6 +56,7 @@ manifest.
id: GLAS-WP-0018-T03
status: todo
priority: medium
state_hub_task_id: "3e2baf39-0b0e-5dd4-bb72-ebc5b72e3b0b"
```
Define `AgentIdentityIssuer` with a test double. Gateway obtains a per-run token
@ -66,6 +70,7 @@ teardown. Never put the token in argv, task file, evidence or Hub detail.
id: GLAS-WP-0018-T04
status: wait
priority: medium
state_hub_task_id: "5dd4ea64-172a-583e-a353-407c0734bf55"
```
Blocked on key-cape (agent-token issuance, `act`, revocation) and the sand-boxer
@ -79,6 +84,7 @@ rein-aharness task.
id: GLAS-WP-0018-T05
status: todo
priority: medium
state_hub_task_id: "66bb42e1-bb6b-5943-8aac-b13425408018"
```
Emit an ActionRecord per observed commit and streamed tool event, with
@ -93,6 +99,7 @@ step defined with net-kingdom (SI-15 verify).
id: GLAS-WP-0018-T06
status: todo
priority: low
state_hub_task_id: "bd782576-eb37-5f71-90cb-cb29c0e96f61"
```
Publish a provider-neutral session identity contract for sessions Glas does not